Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:2550-1

Опубликовано: 29 авг. 2018
Источник: suse-cvrf

Описание

Security update for cobbler

This update for cobbler fixes the following issues:

Security issue fixed:

  • CVE-2018-10931: Forbid exposure of private methods in the API (bsc#1104287, bsc#1104189)

Список пакетов

SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS
koan-2.2.2-0.68.6.1
SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS
koan-2.2.2-0.68.6.1

Ссылки

Описание

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.

Затронутые продукты
SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:koan-2.2.2-0.68.6.1
SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:koan-2.2.2-0.68.6.1
Ссылки